Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Examining Qakbot Infections

Summary: Unit 42 published a Wireshark tutorial walking through a packet capture from a Qakbot (Qbot) information stealer infection, showing how to extract the initial zip archive and the follow-on Windows executable from HTTP traffic. The tutorial notes Qakbot is most often spread through malspam using fake email chains, that executable URLs have ended in 44444.png or 444444.png since December 2019, and that infected hosts show TLS traffic with unusual certificate issuer data plus email-protocol connections to ports such as 25, 110, 143, 465, 587, 993 and 995.

Key Takeaway: The infection chain is visible in ordinary HTTP and TLS traffic, but only if someone is reading it: the zip archive arrived split across hundreds of objects that Wireshark's export menu could not reassemble, and the tell was certificate issuer fields that no legitimate HTTPS traffic would carry. An infected host also opened unencrypted SMTP, IMAP and POP3 connections to public IP addresses, which is not normal Windows client behavior and is the kind of signal that sits in logs until someone looks.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related